Filtering spam into Junk

Spam protection scores every incoming message and files likely spam in the mailbox's Junk folder. It never deletes or rejects a message because of its score, so a mistake is always recoverable. It also does the DKIM signing you turn on for a domain and enforces the sending limits, so mail can't be opened to the internet without it (see setting up the mail server).

Turn it on

You need Email Server installed, with mail delivered through Dovecot (the Delivery into mailboxes card on Server → Services → Mail delivery & DNS).

1. Open Server → Security → Spam protection.
2. Under Server defaults, tick Enable spam protection. Leave Learn from Junk and Inbox moves ticked.
3. Leave the Junk score threshold at 6 to start with, and press Save defaults.
4. Press Apply saved settings.

Saving changes nothing on its own. Until you press Apply saved settings, the page shows Unapplied settings and mail is filtered the old way.

The first apply installs the filter (Rspamd, with its own Redis) and Dovecot's filing and learning parts, checks the configuration, and restarts the mail services, so mail apps may reconnect briefly. The heading then reads Protection is running. If it reads Protection needs attention, the line under it says why. The page checks again every 30 seconds while it's open, or press Refresh.

If Postfix already passes mail through another filter, the apply stops and says so rather than replacing it. Mail is still delivered if the filter is ever unavailable.

How strict it is

Every message gets a score. At or above the threshold (1 to 20) it goes to Junk. Lower numbers catch more spam but also more wanted mail.

To change it for one mailbox, or to add sender exceptions, choose the mailbox under Mailbox rules:

• Junk score (blank uses server default): this mailbox's own threshold.
• Allowed senders: never filed in Junk.
• Always send to Junk: always filed in Junk, never deleted.

Enter one full address per line, up to 100 per list. An address can't be in both lists. Rules match the envelope sender, which can differ from the From address the reader sees, and an allowed address isn't proof of who sent it. Press Save mailbox rules, then Apply saved settings.

Learning from your users

With learning on, the filter learns when someone moves a message:

• into Junk: it's spam;
• from Junk back to Inbox: it's wanted.

This works in webmail and any IMAP app. Deleting a message or moving it to Trash teaches nothing. What it learns is shared by every mailbox on the server, and it needs plenty of examples of both kinds before it starts making a difference. Learning never changes the threshold.

What your customers see

Suspected spam arrives in a folder named Junk, created the first time it's needed. Nothing else changes for them. Point them to the Junk folder, which explains how to check it and how to teach the filter.

To see why a message was filed in Junk, open its original source in a mail app and look for two headers:

• X-Hostctl-Junk-Reason: the score that passed the mailbox's threshold, or a blocked-sender rule.
• X-Spamd-Result: each test the filter ran and its score.

Turning it off

Untick Enable spam protection, press Save defaults, then Apply saved settings. The original delivery settings come back and what the filter learned is kept for next time. DKIM signing stops too.

While mail is open to the internet, turning it off is refused: close mail on Mail delivery & DNS first.

An apply was interrupted

If the page says an apply was interrupted, run this once over SSH, check the mail services, then apply again:

sudo /usr/bin/python3 -I /usr/lib/hostctl-privd/spam_manage.py recover